The bigger story from the Liquid Network exploit is no longer the theft. It is the exit door. More than two weeks after an attacker drained roughly 4,000 BTC from the Bitcoin sidechain, the function that lets holders turn L-BTC back into real Bitcoin is still switched off, and at least one Liquid Federation member has put a number on the delay. Bull Bitcoin has warned some customers to expect up to a 30-day wait before they can reclaim their coins, according to reporting circulated by Bitcoin News on September 23, 2026.
That gap matters because Bitcoin itself has kept moving. BTC traded at $84,429, down 2.2% on the day as of September 23, 2026, per CoinMarketCap. Anyone stuck waiting on a peg-out is exposed to that price action with no way to sell, move, or spend the underlying coins on the main chain.
The choke point is the peg-out, not the sidechain
Liquid restarted block production on September 10, so transactions inside the sidechain work again. The one thing that does not work is the peg-out: the process that destroys L-BTC on the sidechain and releases the matching Bitcoin on the main chain. Until Blockstream reopens that door, L-BTC is a token you can send to other Liquid users but cannot cash out to the base layer.
The math behind the freeze is straightforward. Reporting from Bitcoin News put L-BTC in circulation at 4,234.76 against reserves of 3,632.23 BTC, a shortfall that lines up with the roughly 598 BTC the attacker never returned. Reopening peg-outs before that gap is closed would let the fastest movers redeem in full while later holders hit an empty reserve. Blockstream co-founder Adam Back has said the peg will be covered 1:1 and that peg-out returns in a later step, but no "peg-outs are live" announcement has come.
Bull Bitcoin's 30-day notice
Bull Bitcoin routes a large share of its flow through Liquid, so its users feel the freeze directly. A customer who bought Bitcoin and took delivery as L-BTC now holds a token that cannot leave the sidechain on the normal path. The reported 30-day guidance is a service-level estimate, not a hard settlement date, and it depends on when Blockstream restores peg-outs rather than on anything Bull Bitcoin controls.
For users, the practical takeaway is that a delivered balance is not the same as a spendable one during an incident like this. The coins exist, the peg is backed by Blockstream's commitment, but liquidity is gated by a bridge that a third party has paused for safety.
A cache bug, not a stolen key
The exploit was not a conventional private-key theft. The attacker used a range-proof verification cache flaw in Elements, the open-source software Liquid runs on, to mint roughly 4,000 unbacked L-BTC and peg them out for real Bitcoin. TRM Labs and multiple outlets reported the drain took about 23 minutes and pulled the bulk of Liquid's reserves before block production was halted.
The attacker then declared itself a white hat through Bitcoin OP_RETURN messages, returned 3,400 BTC after Blockstream patched its bridge nodes on September 7, and kept about 598.5 BTC as a self-styled bounty. Blockstream has refused the demand for the remaining coins and continues to engage with the group. That standoff is the reason the reserve gap, and the peg-out freeze, is still open.
The custody lesson for sidechain holders
Liquid is a federated sidechain, which means a fixed set of functionaries hold the real Bitcoin that backs every L-BTC. That design buys faster, cheaper transactions than the base chain, but it also concentrates control: when the federation pauses the bridge, holders wait. This is a different risk profile from holding Bitcoin in your own wallet, where no operator can gate your withdrawals, and it is worth weighing before parking size on any bridged or wrapped representation of an asset.
None of this makes L-BTC worthless. Blockstream's 1:1 commitment, if honored, means holders should eventually be made whole. The cost is time and price risk while the exit stays shut. For anyone who prioritizes always-on access to their coins, the episode is a reminder of why spending and holding from your own keys removes the middle party that can freeze a withdrawal, and why the custody model behind any crypto product you use deserves as much scrutiny as its headline rate.
Overview
An Elements cache bug let an attacker mint about 4,000 unbacked L-BTC and drain roughly $320 million from Liquid on September 6, 2026. White hats returned 3,400 BTC but kept about 598 BTC, leaving a reserve shortfall that has kept peg-outs frozen for more than two weeks. Bull Bitcoin has warned some users to expect up to a 30-day wait to reclaim BTC. Block production runs normally, Blockstream says the peg will be covered 1:1, but until the bridge reopens, L-BTC holders cannot move their coins to the main chain.
